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CYBER SAFETY FOR SCHOOLS FACT SHEET 


Cyber Safety Considerations for K-12 Schools and School Districts 


The Internet allows for access to information 24 
hours a day, 7 days a week. For schools (public and 
nonpublic), online capabilities not only create entrée 
to a vast amount of resources but also facilitate 
distance learning and collaboration between classes 
and students in different locations.t Along with the 
benefits the Internet brings, however, come costs 
such as new threats to students. Recent news articles 
provide examples of these threats: One man extorted 
sexually explicit images from minors using social 
media,' and instances of cyberbullying have 
reportedly soared in New York City schools." These 
incidents can lead to depression and anxiety, health 
complaints, and decreased academic achievement by 
students." 


Some protections for children online are provided by 
Federal law and regulations, such as the Children’s 
Internet Protection Act (CIPA).'” CIPA aims to protect 
children from obscene or harmful content on the 
Internet. Schools or libraries that are eligible to 
receive discounts for telecommunications, Internet 
access, or internal connections through the E-rate 
program (Universal Service Program for Schools and 
Libraries) must certify they have an Internet safety 
policy that blocks or filters access to pictures that are 
obscene, child pornography, or harmful to minors. 


While CIPA may help prevent students from accessing 


inappropriate content on the Internet, this will not 


protect students from the full range of online threats. 


To help address these, information is provided below 


CYBER SAFETY AND CYBERSECURITY 


Cyber threats can impact either the 
human (students, teachers, and staff) or 
the physical or virtual (e.g., information 
technology [IT] networks and systems) 
elements of schools and school districts. 
While there may be some overlap in 
addressing human versus 
physical/virtual threats, preparing for 
re¥-[ol am nV] o-or-] aM aol Ul[a-mial oleimiqelan 
different individuals with experience or 
expertise on that topic and unique 
actions before, during, and after an 

Tati {o(=1al wmmesiel alole) i aat-hVmdal=1a=1 ie) come aleleys1- 
to plan for these threats separately, but 
still under a broader umbrella of cyber 
threats. 


This fact sheet focuses on addressing 
Walger] asm me f-Le)°) (“lam dal-Mvaitere)| 
community—also called cyber safety 
considerations. Another fact sheet 
addressing threats to the school’s or 
school district’s network and systems, 
called cybersecurity, can be found on 
the REMS TA Center’s Website. 
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on the most common online threats facing students and what schools can do before, during, 
and after an incident. 


1 School refers to all types, including private and public, and all grade levels for the purposes of this fact sheet. 


If you have questions or need additional assistance, please contact the REMS TA Center at 1 (855) 781-7367 
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Online Threats to Students 


As well as the threats that all users face when going online, such as computer viruses and email 
scams, students are at risk from the following: 


e Cyberbullying. Cyberbullying is bullying 
that takes place over digital devices Most common places where 
such as cell phones, computers, and 
tablets. Cyberbullying can occur 
through SMS, text, and mobile 


cyberbullying occurs: 


applications (apps) or online in social e Social media, such as Facebook, 
media, forums, or gaming where people Instagram, Snapchat, and Twitter 

can view, participate in, or share e SMS (Short Message Service), also 
content. Cyberbullying includes known as Text Message, sent through 
sending, posting, or sharing negative, devices 

harmful, false, or mean content about e Instant Message (via devices, email 
someone else. It can include sharing provider services, apps, and social 
personal or private information about media messaging features) 

someone else, causing embarrassment e Email 


or humiliation. Some cyberbullying 
crosses the line into unlawful or criminal behavior. 


e |nappropriate Content. Adolescents and children can unintentionally come into contact 
with inappropriate content, such as sexually explicit material. Unsolicited obscene 
materials can also be received electronically. 


e Sexting. Sexting is the sharing and receiving of sexually explicit messages and nude or 
partially nude images via text messages or apps. Sexting, while commonly occurring off 
school grounds, also occurs on school property, with content being sent and viewed on 
cell phones. Of note is that possession of sexually explicit photos received by sexting can 
be considered a type of possession of child pornography from a legal perspective. 


e Sextortion/Ransomware. Students may also become victim to sextortion, possibly via 
ransomware, if they engage in sexting. Sextortion occurs when someone threatens to 
distribute private and sensitive material if not provided with images of a sexual nature, 
sexual favors, or money. Ransomware is a particular form of computer malware in 
which perpetrators encrypt users’ files, then demand the payment of a ransom for users 
to regain access to their data. Ransomware can also include an element of extortion, in 
which the perpetrator threatens to publish data or (possibly sexually explicit) images if 
the victim does not do what the perpetrator wants, such as provide nude photos. 
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e Oversharing. Personal information that is sometimes shared by students includes their 
name, age, address, phone number, and Social Security number. 


e Online Predation. Online predators put victims through “the grooming process,” a series 
of steps by which they build the victim’s trust by sympathizing with him or her or 
feigning common interests, after which they proceed to set up a face-to-face meeting 
with the victim and then move forward with manipulation and seduction. 


Preparing for Online Threats to Students 
Before an Incident 


Schools and school districts can implement 
several cyber policies and procedures to help 
keep their students safe from online threats. 
These include the creation and implementation 
of responsible use policies to ensure that 
students are aware of appropriate online 
behavior, the use of filtering and blocking 
software at school to prevent access to 
inappropriate content, and education about the 
risks of being online and how to stay safe. 


Responsible Use Policies (RUPs) 

Schools and school districts are encouraged to develop an RUP, also known as an Acceptable 
Use Policy, before students are allowed to access the Internet at school via a school device or 
the student’s personal device. An RUP is an agreement written in simple and accessible 
language among parents or guardians, students, and school personnel that outlines the terms 
of responsible use and consequences for misuse. Families are usually expected to acknowledge 
that their child(ren) will follow basic guidelines, and students agree to the standards laid out in 
the policy. RUPs can cover issues such as expectations for online behavior, what resources can 
be accessed, academic integrity when using technology, and how student data and information 
will be used by the school. For example, the New York City Department of Education’s Internet 
Acceptable Use and Safety Policy provides a summary of the policy—including a hyperlink to an 
easy-to-read description for parents/guardians, teachers, and students—and principles for use, 
such as monitoring, privacy, prohibited uses of the Internet systems, and filtering, among 
others.” 


Filtering and Blocking Content 
One of the first ways to prevent students from accessing inappropriate content—either 
deliberately or accidentally—is for schools and school districts to use filtering and blocking 
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software, which allows users access to only preapproved Websites. Teachers and staff can help 
determine what sites should be blocked. Regular audits can also be conducted to ensure that 
appropriate online educational material can still be accessed and to determine if blocked sites 
should remain blocked. 


Digital Citizenship 

Schools and school districts are also encouraged to teach 
students what it means to be a responsible digital citizen 
as part of a broader strategy of promoting a positive 
school climate. A digital citizenship curriculum can 
include topics such as privacy and security, relationships 
and communication, cyberbullying and digital drama, 
digital footprints and reputation, self-image and identity, 
information literacy, and creative credit and copyright. 


As an example of a digital citizenship curriculum used by 
the K-12 school community, the Jurupa Unified School 
District educates students in Internet safety, privacy, 
relationships, cyberbullying, self-image, copyright rules, 
and other topics.” Lessons are age appropriate, and 
discussions change depending on the latest digital trends 
and include topics such as the importance of making 
only constructive comments online. 


Education and Training 
Students, teachers, staff, and families can also be educated on online safety. Three sources of 
information are the following: 

1. Stop.Think.Connect. Campaign (https://www.dhs.gov/stopthinkconnect; U.S. 
Department of Homeland Security) is a national awareness campaign that provides 
resources such as videos, a toolkit, and blogs to help raise the awareness of cyber 
threats and how to be safer online. 


2. NetSmartz® Worskhop (https://www.netsmartz.org/; National Center for Missing and 
Exploited Children® [NCMEC]) provides resources for parents and guardians, educators, 
and law enforcement with the goal of educating, engaging, and empowering children to 
recognize potential Internet threats, talk to adults about risks, prevent themselves from 
being exploited, and report victimization to adults. Separate Websites and resources are 
available for kids, tweens, and teens. 
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3. OnGuard Online program (https://www.consumer.ftc.gov/features/feature-0038- 
onguardonline; Federal Trade Commission) provides instructional material for 
elementary and middle school teachers, high school teachers, and community educators 
and resources for parents on how to talk to their children about being online. 


During and After an Incident 


Students also need to be aware of what to do if they are a victim of an online threat. They can 
be encouraged to report threats to a teacher, a school counselor, another trusted adult, and 
the online service provider, if appropriate. Students, teachers, and other members of the public 
can also contact NCMEC’s CyberTipline to report a concern by submitting an online report at 


https://report.cybertip.org/ or calling 1-800-843-5678. 


If somebody is in immediate danger or a crime may have been committed, students, teachers, 
and staff should contact the school resource officer, police officer, or local law enforcement. 


Relation to Emergency Operations Plan (EOP) Development and Planning 


The Guide for Developing High-Quality School Emergency Operations Plans (School Guide; 
https://rems.ed.gov/docs/REMS K-12 Guide 508.pdf) was developed in partnership with six 
Federal departments and agencies, including the U.S. Department of Education, with roles and 
responsibilities in emergency preparedness. The Schoo! Guide provides a recommended six-step 
planning process that is cyclical and ongoing to help schools develop a high-quality EOP and lists 
several threats and hazards that schools may want to include in the plan, including cyber 
incidents. This type of threat can be addressed in a Cyber Annex to the EOP, which can address 
both cyber safety (i.e., the human element) and cybersecurity (i.e., IT systems and networks). 


When developing activities to address cyber threats before, during, and after an event occurs, a 
planning team can progress through the six steps as follows. 


Step 1: Form a collaborative planning team. The planning team will likely comprise a core 
planning team, school personnel, community partners, and a school district representative. To 
address cyber threats, the planning team can seek the additional input of individuals such as IT 
staff; local, state, and Federal law enforcement; and emergency management, among others. 
When identifying actions to address cyber threats to students, the planning team can also look 
to others who play a role in supporting students’ emotional needs, such as a counselor, a 
bullying coordinator, and other mental/behavioral health professionals. 
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Step 2: Understand the situation. Here, the planning 
team identifies threats, such as cyber threats, and 
hazards to the whole school community using a variety 
of assessment tools, assesses those risks, and prioritizes 
them for inclusion in the EOP. One assessment that can 
be especially useful when identifying online threats to 
Step 1: Form a collaborative the whole school community is a Culture and Climate 
planning team. Assessment. This tool evaluates student, teacher, and 
Step 2: Understand the situation. staff connectedness to the school and potential 
behavior problems. 


SIX-STEP PLANNING PROCESS 


Step 3: Determine goals and 
objectives. 


Step 4: Plan development (identify As students can use online platforms, such as social 


courses of action). 

Step 5: Plan preparation, review, 
and approval. 

Step 6: Plan implementation and 
maintenance. 


media, to pose or make actual threats to students, 
teachers, staff, and/or the locality ranging from bullying 
to targeted violence, another assessment schools 
should consider implementing is a behavioral threat 
assessment. The primary purpose of a threat 
assessment is to prevent targeted violence in schools by 
students, where a school is deliberately selected as the 
location for the attack and is not simply a random site of opportunity. More information is 
available in a REMS TA Center Webinar “Use of Social Media School Behavioral Threat 


Assessments” at https://rems.ed.gov/TA_Webinars.aspx 


Step 3: Determine goals and objectives and Step 4: Plan development (identify courses of 
action). After assessing the level of risk posed by threats and hazards, the planning team should 
work to determine goals and objectives to achieve the best outcome for before, during, and 
after an incident. Then courses of action are developed that describe the who, what, when, and 
how to meet those objectives. 


For example, the planning team can address cyberbullying in the EOP by identifying goals and 
objectives for before, during, and after an incident. The team can then identify courses of 
action to help prevent incidents from occurring, provide ongoing protection to the student 
body, mitigate cyberbullying’s effects, respond to incidents, and help students recover from an 
event. 


Step 5: Plan preparation, review, and approval. Now a draft EOP is written and circulated to 
obtain feedback from those responsible for implementing the document. Edits are made based 
on those comments, and approval is obtained from the appropriate leadership. As the Cyber 
Annex will address both cyber safety and cybersecurity, this part of the document will include 
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goals, objectives, and courses of action for keeping both students and the school’s IT systems 
and networks safe. 


Step 6: Plan implementation and maintenance. Here, the EOP is maintained via regular 
reviews and revised when needed. As new cyber threats are constantly emerging, planning 
teams may decide to review the Cyber Annex more frequently. Further, individuals with roles 
outlined in the EOP are trained in their responsibilities, and exercises are also conducted to test 
the school’s or school district’s ability to respond to a threat or hazard. 


Summary 


The Internet has brought advantages such as access to information and friends anywhere in the 
world and at any time. However, it can also serve as a channel to negatively impact students as 
they unintentionally come across inappropriate content or become the victims of deliberate 
harassment. To help prevent these incidents from occurring, schools and school districts can 
create RUPs, filter and block inappropriate content, and promote digital citizenship through 
instruction on how to stay safe online. If students do become victims, they should be aware of 
whom they can turn to for help—such as a teacher or other trusted adult. Further, planning 
teams should consider laying out protocols and courses of action for before, during, and after a 
cyber incident in the Cyber Annex to the school’s EOP as part of their preparedness efforts. 


Key Resources 


A variety of resources are available to support the cyber safety of students, including: 

e Incorporating Sextortion Prevention, Response, and Recovery into School Emergency 
Operations Plans (EOPs) Webinar, REMS TA Center. This Webinar provided background 
information on sextortion and discussed how students can be victims and perpetrators. 
Presenters shared how education agencies can develop measures to prevent and 
protect students from sextortion with support from local and Federal agencies. 
http://rems.ed.gov/Sextortion2016Webinar.aspx 


e NetSmartz® Workshop Online Program, National Center for Missing and Exploited 
Children®. This program provides online resources for parents and guardians, educators, 
law enforcement, teens, tweens, and kids. Information is provided on specific topics, 
such as cell phones, cyberbullying, and sexting, with accompanying tips and pointers on 
how to discuss these topics with a child. 
http://www.netsmartz.org/Parents 
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e Office of Educational Technology (OET) Web page, U.S. Department of Education. The 
OET develops national educational technology strategy and policy for how technology 
can be used by K-12, higher education, and adult education learners. 
https://tech.ed.gov 


e Privacy Technical Assistance Center, U.S. Department of Education. This Website serves 
as a comprehensive resource that education agencies can use to get information about 
privacy, confidentiality, and security practices. The site provides valuable information 
related to information sharing guidelines, such as the Family Educational Rights and 
Privacy Act (FERPA), and legislation, such as the Children’s Internet Protection Act. 
http://tech.ed.gov/privac 


e StopBullying.gov Website. This Website (http://www.stopbullying.gov/index.html) 
serves as a hub of information on the Federal perspective on bullying and contains 
information and resources to address bullying. Under the Cyberbullying tab, users can 
access Web pages such as: 

© Tips for Teachers, which describes some of the warning signs that a child may be 
involved in cyberbullying and how to prevent and address cyberbullying; and 

o Social Media and Gaming, which lists social media apps and sites commonly used 
by children and teens and what adults can do to prevent cyberbullying of 
children who are gaming. 
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